Skip to content

[Snyk] Upgrade: express, socket.io, socket.io-client#96

Open
WilliamUK17 wants to merge 1 commit intomainfrom
snyk-upgrade-f307d076495a3dfdfb0d59a5fd91f43c
Open

[Snyk] Upgrade: express, socket.io, socket.io-client#96
WilliamUK17 wants to merge 1 commit intomainfrom
snyk-upgrade-f307d076495a3dfdfb0d59a5fd91f43c

Conversation

@WilliamUK17
Copy link
Owner

@WilliamUK17 WilliamUK17 commented Sep 14, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

express
from 4.18.1 to 4.19.2 | 5 versions ahead of your current version | 6 months ago
on 2024-03-25
socket.io
from 4.5.1 to 4.7.5 | 13 versions ahead of your current version | 6 months ago
on 2024-03-14
socket.io-client
from 4.5.1 to 4.7.5 | 14 versions ahead of your current version | 6 months ago
on 2024-03-14

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Denial of Service (DoS)
SNYK-JS-WS-7266574		 482 Proof of Concept
high severity Uncaught Exception
SNYK-JS-ENGINEIO-5496331		 482 No Known Exploit
high severity Uncaught Exception
SNYK-JS-SOCKETIO-7278048		 482 No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-5596892		 482 No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-5596892		 482 No Known Exploit
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 482 No Known Exploit
Release notes
Package name: express from express GitHub release notes
Package name: socket.io
  • 4.7.5 - 2024-03-14

    Bug Fixes

    • close the adapters when the server is closed (bf64870)
    • remove duplicate pipeline when serving bundle (e426f3e)

    Links

  • 4.7.4 - 2024-01-12

    Bug Fixes

    • typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914

    Links

  • 4.7.3 - 2024-01-03

    Bug Fixes

    • return the first response when broadcasting to a single socket (#4878) (df8e70f)
    • typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)

    Links

  • 4.7.2 - 2023-08-02

    Bug Fixes

    • clean up child namespace when client is rejected in middleware (#4773) (0731c0d)
    • webtransport: properly handle WebTransport-only connections (3468a19)
    • webtransport: add proper framing (a306db0)

    Links

  • 4.7.1 - 2023-06-28

    The client bundle contains a few fixes regarding the WebTransport support.

    Links

  • 4.7.0 - 2023-06-22

    Bug Fixes

    • remove the Partial modifier from the socket.data type (#4740) (e5c62ca)

    Features

    Support for WebTransport

    The Socket.IO server can now use WebTransport as the underlying transport.

    WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

    References:

    Until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

    https://w3c.github.io/webtransport/#custom-certificate-requirements)
    const cert = readFileSync("/path/to/my/cert.pem");
    const key = readFileSync("/path/to/my/key.pem");

    const httpsServer = createServer({
    key,
    cert
    });

    httpsServer.listen(3000);

    const io = new Server(httpsServer, {
    transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
    });

    const h3Server = new Http3Server({
    port: 3000,
    host: "0.0.0.0",
    secret: "changeit",
    cert,
    privKey: key,
    });

    (async () => {
    const stream = await h3Server.sessionStream("/socket.io/");
    const sessionReader = stream.getReader();

    while (true) {
    const { done, value } = await sessionReader.read();
    if (done) {
    break;
    }
    io.engine.onWebTransportSession(value);
    }
    })();

    h3Server.startServer();">

    import { readFileSync } from "fs";
    
import { createServer } from "https";
    
import { Server } from "socket.io";
    
import { Http3Server } from "@ fails-components/webtransport";
    

    // WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)
    
const cert = readFileSync("/path/to/my/cert.pem");
    
const key = readFileSync("/path/to/my/key.pem");
    

    const httpsServer = createServer({
    
key,
    
cert
    
});
    

    httpsServer.listen(3000);
    

    const io = new Server(httpsServer, {
    
transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
    
});
    

    const h3Server = new Http3Server({
    
port: 3000,
    
host: "0.0.0.0",
    
secret: "changeit",
    
cert,
    
privKey: key,
    
});
    

    (async () => {
    
const stream = await h3Server.sessionStream("/socket.io/");
    
const sessionReader = stream.getReader();
    

    while (true) {
    
const { done, value } = await sessionReader.read();
    
if (done) {
    
break;
    
}
    
io.engine.onWebTransportSession(value);
    
}
    
})();
    

    h3Server.startServer();

    Added in 123b68c.

    Client bundles with CORS headers

    The bundles will now have the right Access-Control-Allow-xxx headers.

    Added in 63f181c.

    Links

  • 4.6.2 - 2023-05-31

    Bug Fixes

    • exports: move types condition to the top (#4698) (3d44aae)

    Links

  • 4.6.1 - 2023-02-20
  • 4.6.0 - 2023-02-07
  • 4.6.0-alpha1 - 2023-01-25
  • 4.5.4 - 2022-11-22
  • 4.5.3 - 2022-10-15
  • 4.5.2 - 2022-09-02
  • 4.5.1 - 2022-05-17
from socket.io GitHub release notes
Package name: socket.io-client
  • 4.7.5 - 2024-03-14

    Bug Fixes

    • discard acknowledgements upon disconnection (34cbfbb)

    Links

  • 4.7.4 - 2024-01-12

    There were some minor bug fixes on the server side, which mandate a client bump.

    Links

  • 4.7.3 - 2024-01-03

    Bug Fixes

    • improve compatibility with node16 module resolution (#1595) (605de78)
    • typings: accept string | undefined as init argument (5a3eafe)
    • typings: fix the type of the socket#id attribute (f9c16f2)

    Links

  • 4.7.2 - 2023-08-02

    Some bug fixes are included from the engine.io-client package:

    • webtransport: add proper framing (d55c39e)
    • webtransport: honor the binaryType attribute (8270e00)

    Links

  • 4.7.1 - 2023-06-28

    Some bug fixes are included from the engine.io-client package:

    • make closeOnBeforeunload default to false (a63066b)
    • webtransport: properly handle abruptly closed connections (cf6aa1f)

    Links

  • 4.7.0 - 2023-06-22

    Bug Fixes

    • properly report timeout error when connecting (5bc94b5)
    • use same scope for setTimeout and clearTimeout calls (#1568) (f2892ab)

    Features

    Support for WebTransport

    The Engine.IO client can now use WebTransport as the underlying transport.

    WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

    References:

    For Node.js clients: until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

    import { WebTransport } from "@ fails-components/webtransport";

    global.WebTransport = WebTransport;

    Added in 7195c0f.

    Cookie management for the Node.js client

    When setting the withCredentials option to true, the Node.js client will now include the cookies in the HTTP requests, making it easier to use it with cookie-based sticky sessions.

    https://example.com", {
    withCredentials: true
    });">
    import { io } from "socket.io-client";
    

    const socket = io("https://example.com", {
    
withCredentials: true
    
});

    Added in 5fc88a6.

    Conditional import of the ESM build with debug logs

    By default, the ESM build does not include the debug package in the browser environments, because it increases the bundle size (see 16b6569).

    Which means that, unfortunately, debug logs are not available in the devtools console, even when setting the localStorage.debug = ... attribute.

    You can now import the build which includes the debug packages with a conditional import. Example with vite:

    import { defineConfig } from 'vite'
    import react from '@ vitejs/plugin-react'

    export default defineConfig({
    plugins: [react()],
    server: {
    port: 4000
    },
    resolve: {
    conditions: ["development"]
    }
    })

    Reference: https://v2.vitejs.dev/config/#resolve-conditions

    Added in 781d753.

    Links

    • Diff: 4.6.2...4.7.0
    • Server release: 4.7.0
    • engine.io-client version: ~6.5.0 (diff)
    • ws version: ~8.11.0 (no change)
  • 4.6.2 - 2023-05-31

    Bug Fixes

    • exports: move types condition to the top (#1580) (7ead241)

    Links

    • Diff: 4.6.1...4.6.2
    • Server release: 4.6.2
    • engine.io-client version: ~6.4.0 (no change)
    • ws version: ~8.11.0 (no change)
  • 4.6.1 - 2023-02-20

    Bug Fixes

    • do not drain the queue while the socket is offline (4996f9e)
    • prevent duplicate connections when multiplexing (46213a6)

    Links

    • Diff: 4.6.0...4.6.1
    • Server release: 4.6.1
    • engine.io-client version: ~6.4.0 (no change)
    • ws version: ~8.11.0 (no change)
  • 4.6.0 - 2023-02-06

    Bug Fixes

    • typings: do not expose browser-specific types (4d6d95e)
    • ensure manager.socket() returns an active socket (b7dd891)
    • typings: properly type emits with timeout (#1570) (33e4172)

    Features

    A new "addTrailingSlash" option

    The trailing slash which was added by default can now be disabled:

    https://example.com", {
    addTrailingSlash: false
    });">
    import { io } from "socket.io-client";
    

    const socket = io("https://example.com", {
    
addTrailingSlash: false
    
});

    In the example above, the request URL will be https://example.com/socket.io instead of https://example.com/socket.io/.

    Added in 21a6e12.

    Promise-based acknowledgements

    This commit adds some syntactic sugar around acknowledgements:

    // without timeout
    const response = await socket.emitWithAck("hello", "world");

    // with a specific timeout
    try {
    const response = await socket.timeout(1000).emitWithAck("hello", "world");
    } catch (err) {
    // the server did not acknowledge the event in the given delay
    }

    Note: environments that do not support Promises will need to add a polyfill in order to use this feature.

    Added in 47b979d.

    Connection state recovery

    This feature allows a client to reconnect after a temporary disconnection and restore its ID and receive any packets that was missed during the disconnection gap. It must be enabled on the server side.

    A new boolean attribute named recovered is added on the socket object:

    socket.on("connect", () => {
  console.log(socket.recovered); // whether the recovery was successful
});

    Added in 54d5ee0 (server) and b4e20c5 (client).

    Retry mechanism

    Two new options are available:

    • retries: the maximum number of retries. Above the limit, the packet will be discarded.
    • ackTimeout: the default timeout in milliseconds used when waiting for an acknowledgement (not to be mixed up with the already existing timeout option, which is used by the Manager during the connection)
    const socket = io({
    retries: 3,
    ackTimeout: 10000
    });

    // implicit ack
    socket.emit("my-event")<span clas...

@snyk-bot
fix: upgrade multiple dependencies with Snyk
4b4c08b 
Snyk has created this PR to upgrade:
  - express from 4.18.1 to 4.19.2.
    See this package in npm: https://www.npmjs.com/package/express
  - socket.io from 4.5.1 to 4.7.5.
    See this package in npm: https://www.npmjs.com/package/socket.io
  - socket.io-client from 4.5.1 to 4.7.5.
    See this package in npm: https://www.npmjs.com/package/socket.io-client

See this project in Snyk:
https://app.snyk.io/org/p4r4d0xshado/project/f28c3a8b-ef9d-404b-9fb0-90812d837979?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Calling io.emit("event") with events that has no arguments result in TypeScript errors

2 participants

@WilliamUK17 @snyk-bot